RatHat Android Malware Abuses ADB to Retain Shell Access After Uninstall
Zimperium details RatHat, a China-linked Android malware using smishing, Accessibility abuse, local ADB self-pairing, and generative AI to persist after uninstall and steal data.
Researchers at Zimperium report a new Android malware family dubbed RatHat, assessed to be operated by China-based threat actors and delivered through smishing, malvertising, and third-party forums hosting trojanized APKs. The malware abuses Accessibility services to unlock Developer Options, enable Wireless Debugging, and self-pair with the local ADB daemon, staging a Go agent (masquerading as liblocal-service.so) and an FRP reverse-proxy client that run with shell privileges and survive uninstallation by reinstalling via the local ADB service. Its C2 channel collects SMS messages, credentials, lock-screen PINs, screen captures, keystrokes, and installed apps, aided by a hardware-level touch keylogger and overlays impersonating the Google Play Store. RatHat also serializes the live Accessibility tree to XML and queries a popular generative AI assistant to autonomously navigate screens, resolve text, and direct synthetic clicks.
- Distributed via smishing, malvertising, and third-party forums tricking users into installing trojanized APKs.
- Uses Accessibility abuse and local ADB self-pairing to escape the app sandbox and gain shell-level privileges.
- Retains shell access after uninstall and can reinstall itself through the weaponized local ADB daemon.
- Four anti-analysis tricks: container tampering, manifest bombs, DEX bytecode poisoning, and StringCrypto string encryption.
- Uses a generative AI assistant to parse the Accessibility tree and autonomously navigate victim screens.
From the original article
3 min read at thehackernews.com
Cybersecurity researchers have flagged a new Android malware called RatHat that's assessed to be operated by China-based threat actors and features an artificial intelligence (AI)-powered system to navigate and control compromised devices. "Distributed primarily via targeted smishing (SMS/text phishing) and malvertising campaigns leading to deceptive third-party download portals, RatHat uses
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.